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intuitive  termination  functions  in  otherwise  difficult  termination  proofs.  In  particular,  we 
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Proving  termination  with  multiset  orderings  1 

I.  INTRODUCTION 

The  use  of  well-founded  sets  for  proving  that  programs  terminate  has  been  suggested 
by  Floyd  [1967].  A well-founded  set  ( S , » consists  of  a set  of  elements  S and  an 
ordering  > defined  on  the  elements,  such  that  there  can  be  no  infinite  decreasing 
sequences  of  elements.  The  idea  is  to  find  a well-founded  set  and  a termination  function 
that  maps  the  elements  of  the  program  into  that  set,  such  that  the  value  of  the  termination 
function  is  continually  reduced  throughout  the  computation.  Since,  by  the  nature  of  the 
set,  that  value  cannot  decrease  indefinitely,  the  program  must  terminate.  The 
well-founded  sets  most  frequently  used  for  this  purpose  are  the  natural  numbers  under  the 
"greater-than"  ordering  and  n-tuples  of  natural  numbers  under  the  lexicographic  ordering. 


In  this  paper,  we  define  and  illustrate  a class  of  orderings  on  multisets.  Multisets, 
sometimes  called  bags,  are  like  sets,  but  allow  multiple  occurrences  of  identical  elements. 
For  example,  {3,  3,  3,  4,  0,  0}  is  a multiset  of  natural  numbers;  It  is  identical  to  the 

multiset  {0,  3,  3,  0,  4,  3}  , but  is  distinct  from  (3,  4,  0}  . 

The  ordering  > on  any  given  well-founded  set  S can  be  extended  to  form  a 
well-founded  ordering  » on  the  finite  multisets  over  S.  In  this  ordering,  M>M'  , for  two 
finite  multisets  M and  M'  over  S , if  M'  may  be  obtained  from  M by  the  removal  of 
at  least  one  element  from  M and/or  by  the  replacement  of  one  or  more  elements  in  M 
with  any  finite  number  of  elements  taken  from  S , each  of  which  is  smaller  than  one  of  the 
replaced  elements.  Thus,  if  S is  the  set  of  natural  numbers  0,  1,  2,  ...  with  the  > 
ordering,  then  under  the  corresponding  multiset  ordering  » over  S , the  multiset 
{3,  3,  4,  0}  is  greater  than  each  of  the  three  multisets  {3,  4}  , 
(3,  2,  2,  1,  1,  1,  4,  0}  , and  {3,  3,  3,  3,  2,  2}  . In  the  first  case,  two  elements  have 
been  removed;  in  the  second  case,  an  occurrence  of  3 has  been  replaced  by  two 
occurrences  of  2 and  three  occurrences  of  I ; and  in  the  third  case,  the  element  4 has 

been  replaced  by  two  occurrences  each  of  3 and  2 , and  in  addition  the  element  0 has 

been  removed. 

As  an  example  of  the  use  of  a multiset  ordering  for  a proof  of  termination,  consider  the 
following  trivial  program  to  empty  a shunting  yard  of  all  trains: 


agfaMBfug 
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This  program  is  nondeterministic,  as  It  does  not  indicate  which  train  Is  to  be  selected  nor 
how  the  train  is  to  be  split. 

Let  Y denote  the  set  of  trains  in  the  yard,  and  trains(Y)  be  the  number  of  trains  in 
the  yard.  For  any  train  teY  , let  cars(t)  be  the  number  of  cars  it  contains.  We  present 
two  proofs  of  termination. 

If  we  take  the  set  of  natural  numbers  as  our  well-founded  set,  then  we  are  led  to  the 
selection  of  the  termination  function 

T(Y)  = 2*  X cars(t ) - trains(Y) 
teY 

(see  Dijkstra  [1976]).  This  solution  uses  the  fact  that  "splitting"  conserves  the  number 
of  cars  in  the  yard,  X cars(t)  . Thus,  splitting  a train  increases  the  number  of  trains  in  the 
yard,  trainsW)  , by  I , thereby  decreasing  the  current  value  of  the  termination  function 
T by  I . Removing  a one-car  train  from  the  yard  reduces  2*2  carj(r)  by  2 and 
increases  - trains(Y ) by  1 , thereby  decreasing  r by  I . 

If  we  use  multisets  of  natural  numbers  as  our  well-founded  set,  then  the  function 
T(Y)  = {cars(t)  : teY} 

demonstrates  the  termination  of  the  shunting  program.  That  is,  for  any  configuration  of  the 
yard  Y , T(>')  denotes  the  multiset  containing  the  size  of  each  of  the  trains  In  Y . Each 
iteration  of  the  program  loop  clearly  decreases  the  value  of  T(Y ) under  the  multiset 
ordering:  removing  a train  from  the  yard  reduces  the  multiset  by  removing  one  element; 
splitting  a train  replaces  one  element  with  two  smaller  ones,  corresponding  to  the  two 
shorter  trains. 

Programs  are  sometimes  written  in  the  form  of  a production  system.  The  following  system 
of  three  rewrite  rules  is  an  example: 


white,  red  =* 

red,  white 

blue,  red  =» 

red,  blue 

blue,  white  => 

r- 

white,  blue  . 

This  program  solves  the  "Dutch-flag"  problem:  Assuming  that  we  have  a series  of  marbles, 
colored  red  , white  or  blue  and  placed  side  by  side  in  no  particular  order,  then  the  above 
program  will  rearrange  the  marbles  so  that  all  the  red  marbles  are  on  the  left,  all  blue 
marbles  are  on  the  right,  and  all  white  marbles  are  in  the  middle.  The  first  rule,  for 
example,  states  that  if  anywhere  in  the  series  there  is  an  adjacent  pair  of  marbles,  the 
left  one  white  and  the  right  one  red  , then  they  should  be  exchanged  so  that  the  red 
marble  is  on  the  left  and  the  white  one  is  on  the  right. 
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The  three  rules  may  be  applied  in  any  order  and  to  any  pair  of  marbles  matching  a 
left-hand  side  of  a rule.  The  program  terminates  when  no  rule  can  be  applied.  Clearly,  If 
no  rule  can  be  applied,  the  marbles  are  in  the  desired  order,  since  nowhere  does  a red 
marble  have  anything  but  a red  marble  to  its  Immediate  left  (or  else  one  of  the  first  two 
rules  could  be  applied),  and  nowhere  does  a blue  marble  have  anything  but  a blue  marble 
to  its  right  (or  else  one  of  the  last  two  rules  could  be  applied).  The  only  thing  we  need  to 
ascertain  is  that  the  program  will  not  just  keep  on  running,  never  reaching  a situation  when 
no  rule  can  be  applied;  in  other  words,  we  must  prove  that  the  above  production  system 
terminates. 

There  are  several  ways  of  proving  termination.  The  three  we  give  here  all  use  the 
following  ordering  on  colors: 

blue  is  greater  than  white  and  white  is  greater  than  red  . 

It  follows  from  the  transitivity  of  orderings  that  blue  Is  also  greater  than  red  . 

The  first  method  counts  the  total  number  of  "inversions"  of  marbles,  i.e.  the  number  of 
pairs  of  marbles  a and  b (not  necessarily  adjacent),  such  that  a appears  to  the  left  of 
b and  the  color  of  a is  greater  than  the  color  of  b . For  example,  if  five  marbles  are 
arranged  blue,  red,  white,  red,  blue  , then  there  are  four  inversions:  blue-red  , blue-white  , 
blue-red  , and  white-red  . Thus,  the  well-founded  set  is  the  set  of  natural  numbers  under 
their  standard  > ordering,  and  the  termination  function  counts  the  number  of  inversions  by 
summing,  for  each  marble,  the  number  of  marbles  with  a greater  color  to  its  left.  Each  of 
the  rules,  when  applied,  eliminates  one  Inversion  by  exchanging  the  positions  of  one 
inverted  pair,  thereby  reducing  the  value  of  the  termination  function  by  one. 

For  the  second  method,  suppose  that  there  are  n marbles.  The  well-founded  set  we 
use  is  the  set  of  n-tuples  of  colors.  This  tuple  is  ordered  lexicographically,  it  is  reduced  If 
some  component  is  reduced  without  changing  any  component  to  its  left.  The  termination 
function  simply  yields  the  tuple  containing  the  colors  of  the  marbles  in  order,  from  left  to 
right.  To  prove  termination,  we  note  that  whenever  one  of  the  rules  is  applied  to  two 
marbles,  only  the  values  of  the  two  corresponding  components  of  the  tuple  change.  By  the 
nature  of  the  lexicographic  ordering,  we  need  only  consider  the  change  in  the  left 
component,  and  indeed  it  is  reduced  in  its  color:  if  it  was  blue  , then  now  it  is  either  white 
or  red  , and  if  it  was  white  , then  now  It  is  red  . 

The  third  solution  illustrates  the  use  of  multiset  orderings.  Each  of  the  n positions  in 
the  series  is  assigned  a number,  beginning  with  n- 1 at  the  left,  and  going  down  to  0 for 
the  rightmost  position.  We  take  the  multisets  of  pairs  of  the  form  ( position , color)  as  the 
well-founded  set.  The  position- color  pairs  are  ordered  lexicographically:  we  say  that  a 
pair  is  greater  than  another,  If  it  has  a higher  position  number  than  the  other,  or  If  it  has 
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the  same  position  number  but  a greater  color.  For  each  marble,  the  termination  function 
yields  one  pair,  giving  its  position  and  color.  When  a rule  is  applied  to  the  marbles  at 
positions  i and  i- 1 , it  decreases  the  value  of  the  multiset  by  decreasing  the  color  of  the 
marble  at  position  i . The  fact  that  the  color  at  position  i-1  is  increased  does  not  matter, 
since  any  pair  with  position  i is  lexicographically  greater  than  any  pair  with  position  i-1  , 
regardless  of  the  colors. 

These  two  examples  have  demonstrated  how  the  multiset  ordering  may  be  used  in 
termination  proofs.  These  proofs,  however,  did  not  have  a clear  advantage  over  the 
alternative  proofs,  using  the  more  common  "greater-than"  relation  on  the  natural  numbers 
and  lexicographic  ordering  on  n-tuples.  In  practice  using  these  conventional  orderings 
often  leads  to  complex  termination  functions  that  are  difficult  to  discover.  For  example, 
the  termination  proofs  of  programs  involving  stacks  and  production  systems  are  often  quite 
complicated  and  require  much  more  subtle  orderings  and  termination  functions.  Finding  an 
appropriate  ordering  and  termination  function  for  such  programs  is  a well-known  challenge 
among  researchers  in  the  field  of  program  verification.  In  the  remainder  of  this  paper,  we 
shall  demonstrate  how  the  multiset  ordering  permits  the  use  of  relatively  simple  and 
intuitive  termination  functions  in  otherwise  difficult  termination  proofs. 

In  the  next  section,  Section  II,  we  rigorously  define  the  multiset  ordering  and  prove  that 
it  is  well-founded.  In  Section  III,  we  apply  the  multiset  ordering  to  a number  of  termination 
proofs  of  programs.  Then,  in  Section  IV,  we  use  the  multiset  ordering  to  prove  the 
termination  of  production  systems. 
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II.  THE  MULTISET  ORDERING 

A *>  rtially -ordered  set  (5,  >)  consists  of  a set  S and  a transitive  and  Irreflexive 
binary  relation  > on  elements  of  S . For  example,  both  the  set  Z of  all  Integers  and  the 
set  W of  nonnegative  integers  are  ordered  by  the  "greater-than"  relation  > . The 
ordering  may  be  partial:  for  two  distinct  elements  a and  b of  the  set,  we  may  have 
neither  a>b  nor  b>a  . 

A partially-ordered  set  is  said  to  be  well-founded  if  there  can  be  no  infinite  decreasing 
sequences  of  elements  from  the  set.  Thus,  the  set  (W,  >)  is  well-founded,  since  any 
descending  sequence  of  natural  numbers  cannot  go  beyond  0 . On  the  other  hand,  the 
partially-ordered  set  (Z,  >)  is  not  well-founded. 

For  a given  partially-ordered  set  (5,  >)  , we  consider  the  multisets  over  S , i.e. 
unordered  collections  of  elements  ("sets")  that  may  have  multiple  occurrences  of  identical 
elements.  We  denote  by  til(S)  the  set  of  all  finite  multisets  with  elements  taken  from  the 
set  5 , and  associate  an  ordering  » on  W/(S)  that  is  induced  by  the  given  ordering  > 
on  5 . 

In  the  following  definition,  as  well  as  in  the  rest  of  this  paper,  set  operators  will  denote 
their  multiset  analogues:  The  equality  A=B  of  two  multisets,  for  example,  means  that  any 
element  occurring  exactly  n times  in  A , also  occurs  exactly  n times  in  B , and  vice 
versa.  The  union  of  two  multisets  AUB  is  a multiset  containing  m+n  occurrences  of  any 
element  occurring  m times  in  A and  n times  in  B . For  example,  the  union  of  the 
multisets  {2,  2,  4}  and  {2,  0,  0}  is  {2,  2,  4,  2,  0,  0}  . 

For  a partially-ordered  set  (5,  » , the  multiset  ordering  » on  W(S)  Is  defined  as 
follows: 


M > M' 

if  for  some  multisets  X,  Y,  Z in  W(S)  , where  X is  not  empty, 
M • XU  Z and  M'  = KUZ 


and 


(VyeKXBxeX)  x>y  . 

In  words,  a multiset  is  reduced  by  the  removal  of  at  least  one  element  (those  in  X ) and 
their  replacement  with  any  finite  number  — possibly  zero  — of  elements  (those  in  Y ),  each 
of  which  is  smaller  than  one  of  the  elements  that  have  been  removed. 
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We  must  first  show  that  » is  in  fact  a partial  ordering,  i.e.  that  If  > is  irreflexive  and 
transitive,  then  >>  also  is: 

• To  show  irreflexivity,  we  must  show  that  there  can  be  no  multiset  M such  that 

. Suppose  that  M>M  , then  there  would  be  some  nonempty  finite  multiset  X , 
such  that  M=XUZ  and  (\/)ieX)(3x€X)x>)i  . In  other  words,  for  every  element  of  X there 
would  be  a distinct  element  of  X greater  than  it,  which  is  impossible  for  a finite  X . 

• To  show  transitivity  of  > , consider  the  following  irreflexive  relation  »'  on  multisets  in 
V)(S ) : ZU{x}»'ZUK  if  ( VyeY)x>y  . In  other  words,  a finite  multiset  is  reduced  in  the 

relation  »'  by  replacing  a single  element  with  zero  or  more  smaller  elements.  Note  that 
the  multiset  ordering  » is  the  transitive  closure  of  the  relation  »'  , i.e.  Af»Af'  if  and 
only  if  M’  can  be  obtained  from  M by  replacing  elements  in  M one  by  one.  It  follows 
that  » is  transitive. 

We  have  the 

THEOREM:  The  multiset  ordering  (W/(S),  >)  over  (5,  » is  well-founded,  if  and 
only  if  (S,  >•)  is. 

Proof : 

• "only  if"  part.  If  (5,  >)  is  not  well-founded,  then  there  exists  an  infinite  decreasing 

sequence  ...  of  elements  in  S . The  corresponding  sequence  of  singletons 

. . . forms  an  infinite  decreasing  sequence  of  elements  in  M(S)  , and 
(W/(S),  >&-)  is  therefore  not  well-founded. 

• "if"  part.  Assume  that  (5,  >)  is  well-founded.  We  first  extend  S by  adding  to  it  an 

element  1 , and  extend  the  ordering  > on  5 to  make  1 the  least  element,  i.e.  for  every 
element  s*  1 in  5,  . Clearly  S remains  well-founded,  thereby.  Now,  suppose  that 

0//(S),  >)  Is  not  well-founded;  therefore,  there  exists  an  infinite  decreasing  sequence 
M „»Af  ,>  ...  of  multisets  from  W )(S)  . We  derive  a contradiction  by  constructing 
the  following  tree.  Each  node  In  the  tree  is  labelled  with  some  element  of  S ; at  each 
stage  of  the  construction,  the  set  of  all  terminal  nodes  in  the  tree  forms  a multiset  in 
W/(S)  . 


Begin  with  a root  node  with  children  corresponding  to  each  element  of  AT,  . 
Then  since  there  must  exist  multisets  X,Y,  Z,  such  that 

M =XUZ  , M.=YUZ  , X is  not  empty,  and  (\/yeY)(3xeX)x>y  . Then  for  each 
yeY  , add  a son  labelled  y to  the  corresponding  x . In  addition,  grow  a child 
1 from  each  of  the  elements  of  X . (Since  X is  nonempty,  growing  1 
ensures  that  even  if  Y is  empty,  at  least  one  node  Is  added  to  the  tree. 
Since  Y is  finite,  the  nodes  corresponding  to  X each  have  a finite  number 
of  sons.)  Repeat  the  process  for  , and  so  on. 


I 

hi  1 

i 
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Since  at  least  one  node  is  added  to  the  tree  for  each  multiset  Mf  in  the  sequence,  were 
the  sequence  infinite,  the  tree  corresponding  to  the  sequence  would  also  be.  But  by 
Konig’s  Infinity  Lemma,  an  infinite  tree  (with  a finite  number  of  children  for  each  node)  must 
have  an  infinite  path.  On  the  other  hand,  by  our  construction,  all  paths  in  the  tree  are 
descending  in  the  well-founded  ordering  > on  S , and  must  be  finite.  Thus,  we  have 
derived  a contradiction,  implying  that  the  sequence  M t,  Af„,  My  . . . cannot  be  infinite. 

□ 


Remark:  If  (S,  >)  is  totally  ordered,  then  for  any  two  multisets  M , M ' e W/(S)  , one  may 
decide  whether  M»M'  by  first  sorting  the  elements  of  both  M and  M'  in  descending 
order  (with  respect  to  the  relation  > ) and  then  comparing  the  two  sorted  sequences 
lexicographically.  For  example,  to  compare  the  multisets  {3,  3,  4,  0}  and 
{3,  2,  1,2,  0,  4}  , one  may  compare  the  sorted  sequences  (4,  3,  3,  0)  and 
(4,  3,  2,  2,  I,  0).  Since  (4,  3,  3,  0)  is  lexicographically  greater  than 
(4,  3,  2,  2,  1,0),  it  follows  that  {3,  3,  4,  0}»{3,  2,  1,  2,  0,  4}  . □ 


Remark:  I f (S,  >1  is  of  order  type  a , then  the  multiset  ordering  OHS),  >)  over  (S,  >)  is 

of  order  type  1*)°  . This  follows  from  the  fact  that  there  exists  a mapping  4>  from  W(S) 
& 

onto  W that  is  one-to-one  and  order-preserving,  i.e.  if  M>M'  for  M,  M '€)W(S)  , then 
the  ordinal  \p(M)  is  greater  than  . That  mapping  is 


*(M)  = 


V 


me 


tu 


u> 


*P(m) 


where  £ denotes  the  natural  (i.e.  commutative)  sum  of  ordinals,  and  is  the 
one-to-one  order-preserving  map  from  5 onto  a . □ 


Remark:  Consider  the  special  case  where  there  is  a bound  k on  the  number  of 

replacement  elements,  i.e.  |K|<fe  . Any  termination  proof  using  this  bounded  multiset  ordering 
over  IN  may  be  trans’a'ed  into  a proof  using  (IN,  >)  . This  may  be  done  using  the 
order-preserving  function 

*(M,  ■ 

which  maps  multisets  over  the  natural  numbers  into  the  natural  numbers  by  summing  the 

number  kn  for  every  natural  number  n in  a multiset  M . Two  special  cases  of  interest 
are:  if  |X|<|X|  (i.e.  the  size  of  the  multiset  is  not  increased),  then  the  simpler  function 

*(«)  = „6^  - * (M| 

is  order-preserving;  if  |K|=|V|  (i.e.  the  size  of  the  multiset  is  constant),  then 


■ i«  n '■  'n 
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n 

neM 


is  order-preserving.  □ 

We  turn  now  to  consider  nested  multisets,  by  which  we  mean  that  the  elements  of  the 
multisets  may  belong  to  some  base  set  S , or  may  be  multisets  of  elements  of  5 , or  may 
be  multisets  containing  both  elements  of  5 and  multisets  of  elements  of  5 , and  so  on. 
For  example, 

{{I.  1).  {{0},  1,  2},  0} 

is  a nested  multiset.  More  formally,  given  a partially-ordered  set  (S,  » , a nested  multiset 
over  S is  either  an  element  of  S , or  else  it  is  a finite  multiset  of  nested  multisets  over 
S . We  denote  by  W l*(S)  the  set  of  nested  multisets  over  S . 

We  define  now  a nested  multiset  ordering  »*  on  W*(S)  ; it  is  a recursive  version  of  the 
standard  multiset  ordering.  For  two  elements  M , M'eW*(S)  , we  say  that 

M»*M' 


• M,  M'eS  and  M>M’ 

(two  elements  of  the  base  set  are  compared  using  > ), 
or  else 

• MtS  and  Af'eS 

(any  multiset  is  greater  than  any  element  of  the  base  set), 
or  else 

• M , M'$.S  , and  for  some  X,  Y,  ZeW*(S)  , where  X Is  not  empty, 

M = XUZ  and  M’  = YUZ 


(VjieKHBxeX)  x>*y  . 

For  example,  the  nested  multiset 

{{I.  I).  {{0>,  I,  2>,  0} 

is  greater  than 

{{1,  0,  0>,  5,  {{0},  I,  2},  0}  , 

since  {I,  1}  is  greater  than  both  {1,  0,  0}  and  5.  The  nested  multiset 

{{1.  1>,  {{0>,  I.  2>,  0} 


is  also  greater  than 


; 
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{{{}.  1.  2},  {5.  5,  2),  5}  , 

. 

since  {{0},  1,2}  is  greater  than  each  of  the  three  elements  {{},  1,2),  {5,  5,  2}  , 
and  5 . 

Let  w/(S)  denote  the  set  of  all  nested  multisets  of  depth  i . In  other  words, 

W /^(S)=S  and  ft/  *(S)  contains  the  multisets  whose  elements  are  taken  from  V)^(S)  , 

1 i i 

VI  (S) VI  (5)  , with  at  least  one  element  taken  from  VI  (S)  . Thus,  the  set  W?*(S) 

0 1 2 

is  the  infinite  union  of  the  disjoint  sets  VI  (S),  VI  (S),  VI  (5) The  following 

property  holds: 

! For  two  nested  multisets,  M and  M'  , if  the  depth  of  M is  greater  than  the 

depth  of  M'  , then  Af»*AT  . 

' In  other  words,  the  elements  of  V f(S)  are  all  greater  than  the  elements  of  W^(S)  , for  any 

j<i  . 

Proof:  This  property  may  be  proved  by  induction  on  depth.  It  holds  vacuously  for  M of 
depth  0 . For  the  inductive  step,  assume  that  nested  multisets  of  depth  i are  greater 
than  nested  multisets  of  depth  less  than  i ; we  must  show  that  a nested  multiset  M of 
depth  i+1  is  greater  than  any  nested  multiset  M'  of  lesser  depth.  If  the  depth  of  M' 

is  0 , then  M'eS  while  M$S  , and  therefore  M»*M'  , as  desired.  If  the  depth  of  M'  Is 
less  than  i but  greater  than  0 , then  each  of  the  elements  in  M'  is  of  depth  less  than 
i-1  . The  nested  multiset  M , on  the  other  hand,  is  of  depth  i+1  and  must  therefore 
contain  some  element  of  depth  i . By  the  inductive  hypothesis,  that  element  Is  greater 

than  each  of  the  elements  in  M'  . Again,  it  follows  that  M>*M'  . □ 

The  relation  »*  is  a partial  ordering;  it  can  be  shown  to  be  both  irreflexive  and 
transitive.  The  following  theorem  gives  the  condition  under  which  it  is  well-founded: 

THEOREM:  The  nested  multiset  ordering  ( VI* (S ),  >*)  over  (5,  >)  is 
well-founded,  if  and  only  if  (S,  >)  is  well-founded. 

Proof : 

• "only  if"  part.  If  (S,  >•)  is  not  well-founded,  then  there  exists  an  infinite  decreasing 
sequence  ...  of  elements  in  S . This  sequence  is  also  an  infinite  decreasing 

sequence  of  elements  in  V/*(S)  under  »*  , and  (V l*(S),  >*)  is  therefore  not 
i well-founded. 

i i f • 


i 
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• "if"  part.  In  order  to  show  that  (W/*(S),  »*)  is  well-founded,  it  suffices  to  show  that 

each  w/(S)  is  itself  well-founded  under  >*  . For  assume  that  W*(S)  were  not 
well-founded,  then  there  would  exist  an  infinite  decreasing  sequence  of  nested  multisets 

M ,»*AY  ,>*  ...  .By  the  above  property,  the  depth  of  any  nested  multiset  M u in  the 
sequence  cannot  be  greater  than  the  depth  of  its  predecessor  Mj  . Since  the  sequence 
is  infinite,  it  must  have  an  infinite  subsequence  of  nested  multisets  all  of  the  same  depth 

i , which  contradicts  the  well-foundedness  of  v/(S)  . 

We  prove  that  each  (W/(S),  »*)  is  well-founded  by  induction  on  i : The  ordering  >* 
on  W/°(5)=5  is  simply  the  ordering  > on  5 , and  it  follows  that  (W/°(S),  »•*)  is 
well-founded.  For  the  inductive  step,  assume  that  each  (W/(S),  >*)  , j<i  , is 
well-founded,  and  note  that  each  of  the  elements  of  M f(S)  is  a member  of  the  union  of 

W/°(S),  «/  *(5)  . By  the  induction  hypothesis,  each  of  these  w/(S)  is 

well-founded  under  »*  ; therefore  their  union  under  >*  also  Is.  Furthermore,  the 

ordering  »*  on  two  nested  multisets  from  «/(J)  Is  exactly  the  standard  multiset 
ordering  over  that  union,  and  since  the  union  is  well-founded,  so  is  W?*(5)  . □ 

Remark : We  have  seen  above  that  for  (5,  >)  of  order  type  a , the  multiset  ordering 

Ct 

( tW(S ),  »)  is  of  order  type  W . In  a similar  manner,  it  can  be  shown  that  the  order  type 

of  («/(S),  »*)  is 


i times 


the  limit  of  which  is  the  ordinal  «„  — provided  that  a is  less  than  . Thus,  if  (5,  >)  is 
of  order  type  less  than  «r,  , then  ( W*(5 ),  »*)  is  of  order  type  «(1  . (Gentzen  [1938)  used  an 
«n  ordering  to  prove  the  termination  of  his  normalization  procedure  for  proofs  in 
arithmetic.)  n 


In  the  following  two  sections,  we  shall  apply  the  multiset  ordering  to  problems  of 
termination,  first  proving  the  termination  of  programs,  and  then  proving  the  termination  of 
production  systems. 


« 4 
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III.  TERMINATION  OF  PROGRAMS 

The  following  basic  theorem  is  generally  used  to  prove  the  termination  of  programs: 

THEOREM  (Floyd):  A program  P with  variables  x ranging  over  a domain  D 
terminates,  if  and  only  if  there  exist 

a set  of  labels  ,f  cutting  all  the  loops  in  P , 
a well-founded  set  (W , >)  , and 
a termination  function  T mapping  .fxD  into  W , 
such  that  whenever  control  traverses  a path  from  one  label  to  another,  the  value  of  the 
termination  function  T^(x)  decreases  for  the  current  label  L and  value  of  x . 


Proof : 

• "only  if"  part.  If  the  program  does  terminate,  then  the  set  U'xD,  >p)  is  well-founded, 
where  the  relation  >p  is  defined  so  that  ( L , d)>p(L',  d')  if  the  program  reaches  the 
label  L with  the  value  d before  it  reaches  L'  with  the  value  3'  . Thus,  if  TL(x) 
returns  the  pair  (L,  x)  , then  with  each  traversal  of  a path,  the  current  value  of  TL(x) 
decreases. 

• "if"  part.  If  the  program  does  not  terminate,  then  there  exists  an  infinite  sequence  of 
label-value  pairs  (Lr  df,  (L„,  3„),  ....  corresponding  to  the  sequence  of  labels 
through  which  control  passes  during  a nonterminating  computation  and  the  values  of  the 
variables  at  those  points.  Since  the  function  T decreases  with  each  traversal  of  a path, 
it  follows  that  the  sequence  T,  (df,  T(  (d}),  . . . forms  an  infinite  decreasing  sequence 

in  the  set  W , contradicting  its  well-foundedness. 

In  the  following  examples,  we  shall  prove  the  termination  of  programs  using  multiset 
orderings  as  the  well-founded  set. 


EXAMPLE  1 : Counting  tips  of  binary  trees. 

Consider  a simple  program  to  count  the  number  of  tips  — terminal  nodes  (without 
descendents)  — in  a full  binary  tree.  Each  tree  y that  is  not  a tip  has  two  subtrees, 
left(y)  and  rightly)  . The  program  is 
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5 :=  (/) 
c :=  0 

loop  until  S=(  ) 

y :=  s, 


if  tip(y)  then 

5 0W  . . 

. , o 

c :=  c+l 

else 

5 :=  . . 

. , J,,  left{y),  right(y)) 

fi 

repeat 


It  employs  a stack  5 with  the  |S|  elements  . . . , s,  , and  terminates  when  S Is 

empty.  At  that  point,  the  variable  c is  to  contain  the  total  number  of  tip  nodes  in  the 

given  tree  t . 

Initially  the  given  tree  is  placed  in  the  stack.  With  each  iteration  the  subtree  at  the  top 
of  the  stack  is  tested  to  determine  whether  it  is  a tip:  if  it  is,  then  it  is  removed  from  the 

stack  and  the  count  is  incremented  by  1 ; if  it  is  not  a tip,  then  It  is  replaced  in  the  stack 

with  its  two  subtrees,  so  that  the  number  of  tips  in  each  subtree  may  be  counted. 

The  termination  of  this  program  may  be  proved  using  the  well-founded  set  (N,  >)  . The 
appropriate  termination  function  is 

T (5)  = E nodes(s)  , 

.seS 

where  nodes(s)  is  the  total  number  of  nodes  in  the  subtree  s — not  just  the  tip  nodes.  To 
show  that  the  value  of  T decreases  with  each  loop  iteration,  we  must  consider  two 
cases:  If  the  subtree  st  is  a tip  node,  then  that  node  is  removed  from  the  stack,  and  the 
sum  is  decreased  by  I . If  is  not  a tip,  then  it  is  replaced  by  its  two  subtrees,  left(st) 
and  right(st ) . But  i,  contains  one  node  more  than  left(s{)  and  right(st)  combined,  and 
again  the  sum  is  reduced. 

Using  the  multiset  ordering  over  trees,  we  can  prove  termination  with  the  simple 
termination  function 

T(S)  = {j  : je5}  , 

where  the  trees  themselves  are  ordered  by  the  natural  well-founded  subtree  ordering,  l.e. 
any  tree  is  greater  than  its  subtrees.  Thus,  removal  of  a tree  from  the  stack  decreases 
T in  the  multiset  ordering  by  removing  an  element,  and  the  replacement  of  a tree  with  two 
smaller  subtrees  decreases  T . 
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This  solution  uses  multisets  over  trees.  One  could  Just  as  well  have  used  multisets  over 
natural  numbers,  taking  as  the  termination  function  {nodes(s):seS)  or  . The 

first  solution,  using  the  conventional  well-founded  set  (N,  >)  , does  not  provide  such 
flexibility.  Q 


EXAMPLE  2:  McCarthy's  91- function . 

The  following  is  a contrived  program  to  compute  the  simple  function 
/(*)  = if  at >100  then  x-10  else  91 

over  the  set  of  integers  2 , In  a round-about  manner.  Though  this  program  is  short,  the 
proof  of  its  correctness  and  termination  are  nontrivial,  and  for  this  reason  it  is  often  used 
to  illustrate  proof  methods. 

The  program  is: 

n :=  I 
z :=  x 

loop  L : assert  /(x)=/n(z),  «>1 

if  z>100  then  n :=  n-1 
z :=  z- 10 
else  n :=  n+1 
z :=  z+11 
fi 

until  n= 0 
repeat 

assert  z=/(x)  . 


The  predicates  /(x)=/n(z)  and  n>l  , in  the  assert  clause  at  the  head  of  the  loop,  are 
invariant  assertions;  they  hold  whenever  control  is  at  label  L . When  the  program 
terminates,  the  variable  z contains  the  value  of  /(x)  , since  the  loop  is  exited  when  the 

0 

condition  n=0  of  the  until  clause  is  satisfied;  at  that  point,  /(x)=/  (z)=z  . 

Using  the  conventional  well-founded  set  (N,  »,  Katz  and  Manna  [1975]  prove  the 
termination  of  this  program  with  the  termination  function 

T(n,  z)  = -2*z+21*n+2*max(lll,  x) 

• at  L . 
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For  an  alternative  proof  of  termination,  we  consider  the  following  well-founded 
partial-ordering  > on  the  integers: 


a>b  if  and  only  if  a<6< 1 1 1 


(This  is  the  same  ordering  on  integers  as  in  the  usual  structural-induction  proof,  due  to  Rod 
Burstall,  of  the  recursive  version  of  this  program.)  As  the  well-founded  set,  we  use  the  set 
(W/(Z),  »)  of  all  multisets  of  integers,  under  the  corresponding  multiset  ordering.  The 
appropriate  termination  function  T at  L yields  a multiset  in  «/(Z)  , and  is  defined  as 


T (n.  z)  = {z,  f(z), 


fn\ » 


We  must  show  that  for  each  loop  iteration  this  function  decreases.  There  are  three 
cases  to  consider: 


1)  z>100  at  L : In  this  case,  the  then  branch  of  the  conditional  is  executed  and  both 

" Snd  * are  c,ecren,ented.  When  control  returns  to  L (assuming  that  the  loop  has  not 
been  exited),  we  have,  in  terms  of  the  old  values  of  n and  z , 


T(n-1,  z-10)  = <2-10,  /(z-10) /'2(z-J 0)>  . 

Since  z>100  , we  have  /(z)=z-IO  , and  therefore 


T(n-I,  z-10)  = /(z) /-‘(z)}  . 


Thus,  the  value  of  the  termination  function  T has  been  decreased  by  removing  the 


element  z from  the  original  multiset  {z,  /(z),  . . . , /””*(»)} 


2)  90<z<100  at  L : In  this  case,  the  else  branch  is  taken  and  both  n and  z are 
incremented,  yielding 


T(n  + 1,  2 + 11)  = <2+11,  /(z+ 11),  /Wll) /Wll)} 


Since  z+ 11  >100,  we  have  /(z+ 1 1 )=z+ 1 and  /Wll)=/(z+l)  . Furthermore,  either 
z+1-101  or  else  z+l<100,  and  in  both  case  /(z+ 1 )=9 1 =/(z)  and  consequently 

/ (z+ 1 l)=/(z)  . Thus,  we  get 


T(n+1,  Z4ll)  = (z+ll,  Z4l,  /(z) fn'\z)} 


Since  z<z+l<z4ll<m,Wehave  z>z4ll  and  z>z4l  . Accordingly,  the  multiset  has  been 
reduced  by  replacing  the  element  z with  the  two  smaller  elements,  z+ 1 1 and  Z4l  . 


tS  / vi. ..... 
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3)  z<89  at  L : The  else  branch  Is  taken  and  we  have 

T(n+1,  z+ll)  = {z+ll,  /(z+ll),  /2(z+ll) /n(z+ 11)>  . 

2 

Since  z+1 1 < 100  , we  have  /(z+ll)=91  and  / (z+1  l)=/(91)=9l=/(z)  , and  thus 

T(n+1 , z+ll)  = {z+ll,  91,  /(z) /n_1(z)}  . 

Again  z has  been  replaced  by  two  smaller  elements  (under  the  > relation),  z+ll  and 
91  . n 


EXAMPLE  3:  Ackermann’s  function. 

Ackermann's  function  a(m,  n)  over  pairs  of  natural  numbers  is  defined  recursively  as 

a(m,  n)  «=  if  m=0  then  n+1 

else  if  n=0  then  a(m- 1,  1) 

else  a(m-l,  a(m,  n-1)) 
fi  fi  . 

The  following  iterative  program  computes  this  function: 


S :=  (m) 
z :=  n 

loop  L:  assert  a(m,  n)  = fl(xp|,  a(j?,  a(j,,  z))..,)) 

if  s =0  then  S :=  0^ i„) 

z :=  z+1 

else 

if  z=0  then  S :*  (i|S1 st,  x,-l) 

z :=  1 

else  5 :=  (j^ j},  j,-I,  s,) 

z :=  z-1 

fi  fi 

until  J=(  ) 
repeat 

assert  z = a(m,  n)  . 


The  three  branches  of  the  conditional  statement  correspond  to  the  three  cases  In  the 
recursive  program. 

The  termination  of  this  program  was  proved  by  Manna  and  Waidinger  [1978]  using  the 
intermittent-assertion  technique.  We  give  here  two  proofs  using  multisets. 
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• Solution  1 : Consider  the  set  NxN  of  lexicographically-ordered  pairs  of  natural 
numbers,  and  use  the  corresponding  multiset  ordering  over  NxN  . The  termination  function 
at  L is 

T(S,  z)  = {(ilS|+l,  0),  (jpH+l,  0) (j,+  1,  0),  (i,.  z)>  . 

Thus,  T (5,  z)  yields  a multiset  containing  one  pair  per  element  in  the  stack  S . Note  that 
at  L , the  stack  S is  nonempty,  and  all  the  elements  in  5 as  well  as  z are  nonnegative. 

The  proof  considers  three  cases,  corresponding  to  the  three  branches  of  the  conditional 
in  the  loop: 

1 ) ^=0  . If  the  loop  is  not  exited,  then  the  new  value  of  T at  L is 

T((itS|,  ....  O,  z+l)  = {(ip|+l,  0).  . . . , (j,+  l,  0),  (j„,  z+ 1 )}  . 

This  represents  a decrease  in  T under  the  multiset  ordering,  since  the  element  (j  , z) 
has  been  removed  and  the  element  0„+l,  0)  has  been  replaced  by  the  smaller  (s}l  z+l)  . 

2)  sy*0  and  z=0  . In  this  case  we  obtain 

T((Jt„ if.  vl).  D = {(V1-  0) (v'<  °).  (V1-  *)}  . 

Thus,  the  element  (i|P  z)  has  been  replaced  by  the  smaller  element  (j(-l,  1). 

3)  i*  0 and  z*  0 . Here  we  have 

t((jIS| s-\,  i,),  z-1)  = 

«Wl-  0) 0.+  I.-0).  0,,  0),  0,.  z-1))  , 

The  element  (j|t  z)  has  been  replaced  by  the  two  smaller  elements  (j(,  0)  and  (i  , z-1). 

• Solution  2 : As  our  well-founded  set,  we  take  W/(W)xlM  , that  is,  the  set  of  pairs  where 
the  first  component  is  a multiset  over  the  natural  numbers  and  the  second  component  is  a 
natural  number.  For  example,  the  pair  ({3,  3,  0,  1,  1,  2},  2)  is  an  element  of  this  set. 
The  appropriate  termination  function  at  L is 

T(S,  z)  = ({j;.e5  : (\/j<i)  sf>Sj},  z)  ; 

thus,  the  first  component  of  the  pair  is  a multiset  containing  those  elements  j(  in  the 

stack  5 for  which  none  of  sl_] j,,  j,  are  larger  than  . Note  that  j,  always 

belongs  to  the  multiset.  For  example,  if  S=(3,  1,  0,  0,  I)  and  z=0  , then 
T(S , z)=({3,  1,  I),  0).  The  same  case  analysis  as  in  the  previous  solution  applies.  □ 
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EXAMPLE  4:  Program  schema  for  double  recursion. 

Consider  the  following  program  schema  that  utilizes  multisets: 


Here  S is  the  multiset  {s(,  J„,  . . . , Ji$|}  , { } is  the  empty  multiset,  the  statement 

y:e.S  is  the  nondeterministic  assignment  of  an  arbitrary  element  of  S to  y , and  Sv{3>)  Is 
S with  one  occurrence  of  y removed.  By  instantiating  the  predicate  variable  p and  the 
function  variables  h , g , k , l , and  e , one  obtains  an  Instance  of  the  schema  that 
computes  some  particular  function  f(x ) . 

This  iterative  program  computes  the  same  function  /(*)  as  the  recursive  program 
schema 

F(x)  «=  if  p(x)  then  g(x)  else  h(F( ife(x)),  F(/(x)))  fi  , 


provided  that  the  function  h is  associative  and  commutative  and  e is  its  identity 
element  — i.e.  for  all  u , v , and  to  , h(u,  h(v,  w))=h(h(u,  v),  w)  , h(u,  v)-h(v,  u)  , and 
h(u,  e)=u  . 

We  wish  to  show  that  the  loop  of  the  iterative  program  terminates  for  every 
instantiation,  over  some  domain  D , for  which  there  exists  a well-founded  ordering  ( D , >•) 
such  that 

-i p(x)  o x>k(x)  A x>l(x)  . 

(It  Is  under  this  condition  that  the  recursive  program  terminates.)  To  prove  termination, 
consider  the  multiset  ordering  011(D),  »)  over  the  given  domain  (D,  >)  and  the 
termination  function  T(5)=S  at  L . With  each  iteration  an  element  y is  either  removed 
from  S or  replaced  by  the  two  smaller  elements  k(y)  and  l(y)  , thereby  decreasing  T . 

□ 
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Remark:  The  previous  examples  suggest  the  following  heuristic  for  proving  termination: 

given  a program  over  a domain  (D,  » that  computes  some  function  f(x)  , If  the  program 
has  a loop  invariant  of  the  form 

f(x)  = Hf(g,(y)).  f(giy)) /(£„(>)))  , 

try  the  multiset  ordering  (« 1(D),  »)  , and  use  the  termination  function 

t(:v)  = igSyi  giy) g„(y)}  . 

The  idea  underlying  this  heuristic  is  that  T represents  the  set  of  unevaluated  arguments 
of  some  recursive  definition  of  the  function  / . q 
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IV.  TERMINATION  OF  PRODUCTION  SYSTEMS 

A production  system  II  over  a set  of  expressions  £ is  a (finite  or  infinite)  set  of 
rewriting  rules,  called  productions,  each  of  the  form 

*(<*,  0,  ...  ) =*•  ir'(a,  0,  . . . ) , 

where  a , 0 , ...  are  variables  ranging  over  £ . (The  variables  appearing  in  *■'  must  be 
a subset  of  those  in  w .)  Such  a rule  is  applied  in  the  following  manner:  given  an 
expression  re£  that  contains  a subexpression 

ir(a,  b.  . . . ) , 

(i.e.  the  variables  a,  0,  ...  are  instantiated  with  the  expressions  a,  b,  ...  , 
respectively)  replace  that  subexpression  with  the  corresponding  expression 

r'(a,  b,  . . . ) . 

We  write  e-*e'  , if  the  expression  e'  can  be  derived  from  r by  a single  application  of 
some  rule  in  II  to  one  of  the  subexpressions  of  e . 

For  example,  the  following  is  a production  system  that  differentiates  an  expression, 
containing  + and  • , with  respect  to  x : 


Dx  => 

I 

Dy  => 

0 

D(a+0) 

=» 

( Da  + D0  ) 

/)(«•! 8) 

( (0-D«)  + («*Z>0)  ) , 

where  y can  be  any  constant  or  any  variable  other  than  x . Consider  the  expression 
D(Z)(x*x)+;y)  . 

We  could  either  apply  the  third  production  to  the  outer  D , or  else  we  could  apply  the 
fourth  production  to  the  inner  D . In  the  latter  case,  we  obtain 

D(((x*Dx)+(x»£)x))+;y)  , 

which  now  contains  three  occurrences  of  D . At  this  point,  we  can  still  apply  ine  third 
production  to  the  outer  D , or  we  could  apply  the  first  production  to  either  one  of  the  inner 
D's  . Applying  the  third  production  yields 

(D((.x'frx)+{,X'bx))+Dy)  . 


Thus, 


D(D(x-x)+y)  -*  D(((x'Dx)+{x'Dx))+y)  -»  (D((x*Dx)+(x*Dx))+D)i) 
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In  general,  at  each  stage  in  the  computation  there  are  many  ways  to  proceed,  and  the 
choice  is  made  nondeterministically.  In  our  case,  all  choices  eventually  lead  to  the 
expression 

((((MMx-0)M(l-l)+(x-0)))+0)  , 
for  which  no  further  application  of  a production  is  possible. 

A production  system  II  terminates  over  £ , if  there  exist  no  infinite  sequences  of 
expressions  e|t  <■„,  e,,  . . . such  that  et-*e„ . . . and  e,  is  an  expression  in  E . 
In  other  words,  given  any  initial  expression,  execution  always  reaches  a state  for  which 
there  is  no  way  to  continue  applying  productions.  The  difficulty  in  proving  termination  of  a 
production  system  such  as  the  one  for  differentiation  above,  stems  from  the  fact  that 
while  some  productions  (the  first  two)  may  decrease  the  size  of  an  expression,  other 
productions  (the  last  two)  may  increase  its  size.  Also,  a production  (the  fourth)  may 
actually  duplicate  occurrences  of  subexpressions.  Furthermore,  applying  a production  to  a 
subexpression,  not  only  affects  the  structure  of  that  subexpression,  but  also  changes  the 
structure  of  its  superexpressions,  including  the  top-level  expression.  And  a proof  of 
termination  must  take  into  consideration  the  many  different  possible  sequences,  generated 
by  the  nondeterministic  choice  of  productions  and  subexpressions. 

The  following  theorem  has  provided  the  basis  for  most  of  the  techniques  used  for 
proving  the  termination  of  production  systems: 

THEOREM:  A production  system  over  E terminates,  if  and  only  if  there  exists  a 
well-founded  set  (IV , » and  a termination  function  T:£-»IV  , such  that  for  any 
e,  e'  e £ 

e-*e'  implies  T(e)>7(e’)  . 


Proof-. 

• "only  if"  part.  Assume  that  the  system  does  always  terminate,  then  the  set  £ is 
well-founded  under  the  **  ordering,  where  **  is  the  transitive  closure  of  the  relation  -*  . 
Let  ( W , >)  be  (£,  *»)  and  let  T be  the  identity  function.  Then  clearly  e-*e ' implies 

T(e)=e  e'=T(f')  . 

• "if"  part.  Assume  that  «-»«'  implies  r(e)>7{e’)  in  some  well-founded  set  (IV,  >)  . 

Suppose  that  the  system  does  not  terminate.  Then  by  definition,  for  some  expression 
eeE  , there  exists  an  infinite  sequence  of  expressions  ...  . in  that  case, 

there  exists  an  infinite  decreasing  sequence  T(«|)>T(aI)>T(#,)>  ...  in  IV  , which 

contradicts  the  assumption  that  > is  a well-founded  ordering.  Thus,  It  follows  that  the 
system  must  terminate.  □ 
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Several  works  have  considered  the  problem  of  proving  the  termination  of  production 
systems.  Among  them:  Gorn  [1965]  is  an  early  work  that  addresses  this  Issue;  Iturrlaga 
[ 1 96  7 J gives  sufficient  conditions  under  which  a class  of  production  systems  terminates; 
Knuth  and  Bendix  [1969]  define  a well-founded  ordering  based  on  a weighted  size  for 
expressions;  Manna  and  Ness  [1970]  and  Lankford  [1976]  use  a "monotonic 
interpretation"  that  decreases  with  each  application  of  a production;  Upton  and  Snyder 
[1977]  make  use  of  a "value-preserving"  property  as  the  basis  for  a method  of  proving 
termination. 

In  the  following  examples,  we  illustrate  the  use  of  multisets  In  proving  termination 
alongside  some  previous  methods. 

EXAMPLE  1 : Associativity. 

Consider  the  set  of  arithmetic  expressions  £ constructed  from  some  set  of  atoms 
(symbols)  and  the  single  operator  + . The  production  system 


(a+0)+y  =>  a + (0+Y) 


over  £ , contains  just  one  production  which  reparenthesizes  a sum  by  associating  to  the 
right.  For  example,  the  expression  (a+6)+((c+rf)+«)  becomes  either  a+(b+((c+d)+e))  or 
(a+b)+(c+(d+e))  , both  of  which  become  a+(6+(c+(<f+#))) . Since  the  size  of  the  expression 
remains  constant  when  the  production  is  applied,  some  other  measure  is  needed  to  prove 
termination. 


• Solution  I (Manna  and  Ness):  Let  the  well-founded  set  be  (N,  » . The  termination 
function  T:£-»IN  maps  expressions  into  the  well-fo  nded  set,  and  is  defined  recursively  as 
follows: 

T(a+0)  = 2*T(a)+T(0) 
for  expressions  of  the  form  a+0  , and 
T (iv.)  = 1 

for  any  atom  u . For  example,  the  value  of  T for  the  expression  (a+(>)+((e+d)+e)  is 
2*(2,l  + l)+(2*(2,l  + l)+l)  = 13  . 

The  key  point  in  the  proof  is  that  this  function  possesses  the  following  two  Important 
properties: 

1 ) The  value  of  the  termination  function  T decreases  for  the  subexpression  that  the 
production  is  applied  to,  i.e.  for  any  possible  value  of  a , 0 , and  Y , 

T((«+0)+Y)  > T(«+(0+Y))  . 
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This  is  so  since 

T((a+i9)+7)  = 2-T(a+0)+T(Y)  = 4-T(a)+2‘T(0)+T(T)  , 

while 

T (a  + (0+7))  = 2*T(a)+T(0+7)  = 2*T(a)+2*T(0)+T(Y)  . 
and  T(a)  is  at  least  1 . 

2)  The  function  T is  monotonic  in  each  operand  in  the  sense  that  if 
r(f,)  > T(0  , 

for  some  expressions  <*,  and  , then  for  any  expression  ef  , 
T(f,+0  > T(e„+e.)  , 

and 

T(f.+f|)  > T(f,+f„)  . 


Thus,  if  e-*e'  , for  the  outermost  expression  e , then  some  subexpression  (a+0)+7  of 
e has  been  replaced  by  <*  + (0+7)  to  obtain  e' . We  have  T((<*+0)+Y)>T(a  + (0+Y))  , by 
the  first  property.  Therefore,  by  the  monotonicity  property,  we  get  that 

e-*e'  implies  T(e)>T(e')  , 

and  by  the  theorem,  it  follows  that  the  production  system  must  terminate. 


• Solution  2 (Knuth  and  Bendix):  For  this  solution,  the  termination  function  T(r)  yields  a 
sequence  of  natural  numbers,  listing  the  sizes  of  the  subexpressions  of  e in  preorder:  the 
sequence  begins  with  the  size  of  e , |«|  , and  is  followed  by  the  sequence  of  sizes 
corresponding  to  the  left  operand  of  e , and  then  by  the  sequence  of  sizes  corresponding 
to  the  right  operand  of  e . These  sequences  of  sizes  are  compared  lexicographically. 
However,  in  order  for  a set  of  lexicographically-ordered  sequences  to  be  well-founded, 
the  sequences  must  be  of  bounded  length.  In  fact,  the  length  of  T is  constant  for  each 
computation,  since  the  number  of  subexpressions  is  unchanged  by  the  production. 

To  prove  termination  by  this  method,  we  need  to  show  that  any  application  of  the 
production  has  the  following  two  properties: 

1 ) The  value  of  the  termination  function  T decreases  with  each  application  of  a production. 
Since 


|(a+0)+7|  = |a+(0+7)|  , 


Proving  termination  with  multiset  orderings 


23 


we  proceed  to  compare  the  left  operand  a+0  with  a . But 

|a+0|  > M • 

and  therefore  T(rr)  Is  lexicographically  greater  than  T(t')  . 

2)  Since  the  production  does  not  change  the  size  of  the  expression  it  is  applied  to,  l.e. 

1*1  = |*'|  , 

the  sizes  of  all  the  expressions  preceding  ir  in  the  preorder  are  also  unchanged. 

Thus,  e-*e'  implies  that  T(e)  is  lexicographically  greater  than  T(e')  . 

• Solution  3 (multisets):  For  this  solution,  we  use  the  multiset  ordering  over  the  natural 
numbers,  (f.7(M),  »)  , and  let  r:£-»W/(W)  return  the  multiset  of  the  sizes  |«|  of  all  the 
subexpressions  of  the  form  a*0  in  e , i.e. 

T(e)  = {|a|  : a+0  in  «}  . 

For  example, 

T((a+6)+((c+rf)+e))  = {I.  3,  1,  3}  , 
since  the  left  operands  of  the  operator  + are  a , a+b  , c , and  c+rf  . 

Again  there  are  two  crucial  properties: 

1 ) The  value  of  the  termination  function  T decreases  with  each  application  of  a production, 
i.e. 

T((a+0)+ Y)  » r(a  + (0+Y))  . 

Before  an  application  of  the  production,  the  multiset  T((e+0)+Y)  includes  one  occurrence 
of  |a+0|  and  one  of  |a|  , along  with  elements  corresponding  to  the  subexpressions  of  a , 
0 , and  y . After  application  of  the  production,  the  new  multiset  T(a+(/5+Y))  includes 
one  occurrence  of  |a|  and  one  of  |0|  , leaving  the  subexpressions  of  a , 0 , and  Y 
unchanged.  Thus,  the  element  |a+0|  has  been  replaced  by  the  smaller  element  |0|  , and 
the  multiset  has  accordingly  been  decreased. 

2)  Since  the  production  does  not  change  the  size  of  the  expression  it  is  applied  to,  I.e. 


1*1  = l*'l  . 

the  size  of  superexpressions  containing  (cr+0)+Y  is  also  unchanged. 
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The  multiset  T(«)  consists  of  all  the  elements  in  T((a+0)+7)  plus  the  sizes  of  the 
superexpressions  and  the  sizes  of  their  other  subexpressions.  The  only  elements  in  T(e) 
that  are  changed  by  the  production  are  those  in  T (*■)  , and  they  have  been  decreased  by 
the  production.  Thus,  e-*e'  implies  that  T(e)$T(e')  . □ 

EXAMPLE  2:  Distributivity. 

The  following  system  has  two  productions  to  apply  the  distributive  law  to  an  arithmetic 
expression  composed  of  atoms  and  the  operators  + and  • : 

<*•(0+7)  =4  (a*0)+(<**7) 

(0  + 7)*<*  =4-  (0«<*)+(7*<*)  . 

Both  productions  increase  the  size  of  the  expression. 

• Solution  1 (Manna  ana  Ness):  Take  (fcl,  » as  the  well-founded  set.  Let  the 
termination  function  T:£-»N  be  defined  by 

T(<*+0)  = T(a)+T(0)+ 1 

and 

T(<*-0)  = T(a)-T(0)  , 

for  expressions  of  the  form  a+0  or  a*0  , respectively,  and  let 
T(u)  = 2 , 
for  any  atom  u . 

1 ) The  value  of  the  termination  function  T decreases  with  each  application  of  a 
production.  In  fact,  both  productions  decrease  T from 

T(<*MT(0)+T(7)+I)  = T(a)*T(0)  + T(a)«T(7)  + T(«) 

to 

T(a)*T(0)  + T(a)*T(7)  + I . 

Since  T(<*)>2  , this  is  a decrease  of  at  least  1 . 

2)  The  function  T is  monotonic  in  each  operand  of  + and  • . * 

< It  follows  that  e-V  implies  T(e)>T(e')  . t 

] 1 
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• Solution  2 (Upton  and  Snyder):  For  this  method  to  be  applicable,  each  production 
«•=**•'  must  satisfy 

1*1  < br'|  , 

i.e.  the  size  of  the  expression  must  be  increased  by  the  production,  as  is  indeed  the  case 
in  this  example. 

Now,  consider  the  function  val2'.E->U  , which  maps  expressions  into  the  set  of  natural 
numbers,  and  returns  the  arithmetic  value  of  the  expression  when  the  value  2 is  assigned 
to  each  atom.  For  example,  z>a/2((a+l)*(c+0))=(2+2M2+2)=16  . This  function  has  the 
following  two  properties,  which  ensure  termination: 

1 ) val 2 is  monotonic  in  the  sense  that  for  any  subexpression  e'  of  an  expression  e , 
val2(e)  > val2(e')  . 


2)  The  productions  are  value-preserving  for  val2  , i.e. 

va/2(rr ) = val2(t')  , 
for  each  production  *■=»*■'  . 

Suppose  that  the  system  does  not  terminate.  Then  there  exists  an  infinite  sequence  of 
expressions  of  the  form  ....  By  the  value-preserving  property, 

val2(e ,)=va/2(e ,)=va!2(e ,)=  ....  Furthermore,  for  any  given  value  c , the  monotonicity 

property  clearly  imposes  a maximum  depth  c — and  consequently  a maximum  si2e  — on 
any  expression  e such  that  val2(e)=c  . In  particular,  since  the  expressions  in  the 
sequence  have  a constant  value,  they  have  a maximum  size,  say  m , i.e.  |r,|<m  for  any 
ei  in  the  sequence.  On  the  other  hand,  since  each  production  increases  the  size  of  the 
subexpression  it  is  applied  to,  it  follows  that  |*,|<|*t|<|«,|<  . . . , and,  consequently,  there 
must  be  some  n such  that  |r„|>m  . But  this  is  a contradiction.  The  system  must 
therefore  terminate. 

• Solution  3 (multisets):  For  this  solution,  we  use  multisets  over  natural  numbers, 
(M?(M),  »)  . The  termination  function  T:£-»W?(N)  is  defined  by 

T(e)  = (va/l(cf0)  : a-0  in  e)  , 

where  vall(a-0)  gives  the  arithmetic  value  of  cc0  when  all  the  atoms  are  assigned  the 
value  1 . 
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1 ) The  value  of  the  termination  function  T decreases  with  each  application  of  a 

production.  Applying  the  first  production  replaces  the  element  ua/KcKfl+Y))  in  the  * 

multiset  T(ir)  with  the  two  smaller  elements  valHa-0)  and  va/Ha’7)  . The  production 
also  duplicates  the  products  in  a , but  the  value  of  each  subexpression  of  a must  also 
be  less  than  the  value  of  cc(0+>)  . Thus, 

T(ir)  » r(ir')  . 

The  same  is  true  for  the  second  production. 

2)  Since 

vall(ir)  = vall(ir')  , 

the  value  of  superexpressions  of  ir  in  the  multiset  T(e)  is  preserved  by  the  productions. 

Therefore,  e-+e'  implies  T(r)»T(r')  , and  the  system  must  terminate. 

• So/ution  4 (nested  multisets):  Note  that  the  products  are  reduced  in  size  by  each 
production.  One  would  therefore  like  to  prove  termination  using  the  well-founded  set 
(W/(fcl),  »)  , and  a termination  function  that  yields  the  multiset  containing  |a»0|  for  each 
occurrence  of  a product  a-0  : 

ft. 

T(f)  = {|a*0|  : a-0  in  r}  . 

The  value  of  this  function  is  decreased  by  the  application  of  a production,  i.e.  T(r)»T(ir') 
for  each  of  the  two  productions  ir=»*' . The  problem  is  that  the  size  of  superexpressions 
increases,  since  |ir'|>|ir|  ; applying  a production  to  a subexpression  of  e , will  therefore 
increase  T(r)  . 

To  overcome  this  problem,  we  need  a termination  function  that  takes  the  nested 
structure  of  the  expression  into  consideration,  and  gives  more  significance  to  more  deeply 
nested  products.  Fortunately,  this  is  exactly  what  nested  multisets  can  do  for  us.  Since 
this  is  the  first  time  we  illustrate  the  use  of  nested  multisets,  we  shall  discuss  this  solution 
in  greater  detail. 

Let  the  well-founded  set  be  the  nested  multisets  over  the  natural  numbers, 

(W/*(M),  »*)  , and  let  the  termination  function  T:£-+Wi*(M)  yield  |a*0|  for  each 
occurrence  of  a product  a*0  , while  preserving  the  nested  structure  of  the  expression. 

For  example,  the  expression  (a-((6*cM<f+(<-/))))+(£*A)  contains  five  subexpressions  of 

form  a-0  . Their  sizes  are:  J 
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|a-((6-cMd+(<./)))|  =11. 

|(6*c)*(rf+(<*/))|  = 9 . 

IM  = 3 . 

If*/I  = 3 , and 
Ml  = 3 . 

Considering  the  nested  depths  of  the  products,  the  structure  of  the  expression  is 
I (a-<,(b-cMd+(e-f))))+(g-ti)  I 


Ub-cMd+(e-f)))Mg-t>) 

UJ  Gl  I LlJ 


Thus,  for 


< = ((«•(  (b-c)  j (<<+(«;/))  ) ) + (g-/i)  ) , 


we  obtain 


• • ' 

. • • 


TOO  = { {11.  {{3}. 9,  {3}}}.  {3}  } . 


1 ) For  each  production  w=>w' , we  have 
T(ir)  »*  t(t')  , 

under  the  nested  multiset  ordering.  We  have 

T(o-(0+»)  = { {|a*(0+7)|,  tTS),  tW,  } 

while 

T((a./3)4(«.7))  = { 7f5T,  tW),  <|«-Y|,  T&J,  tW)  } . 

where  r(a)‘ , r(0)  , and  7(70  stand  for  the  elements  of  the  multisets  T(a)  , r(0)  , and 
T(y)  , respectively.  This  is  a decrease  In  «/*(N)  , since  {|«-(0+7O|,  TlaJ,  rUff,  TTY)) 
is  greater  than  both  {|a«0|,  T (a),  Tffi)  and  T(aj,  tTyJ)  , regardless  of  the 

exact  form  of  a , 0 and  t . 

For  example, 

TUb-cMd+ie-f)))  = {{{3},  9.  {3)}}  . 

and  applying  the  first  production  yields 

T(((ft«WM(ft*cM«*/))).  = {{{3},  5}.  {{3}.  7.  {3}}}  . 

This  is  a decrease  in  the  nested  multiset  ordering,  since  {{3},  9,  {3}}  is  greater  than 
both  {{3>,  5}  and  {{3>,  7,  {3»  , A similar  argument  applies  to  the  other  production. 
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2)  It  remains  to  ascertain  what  happens  to  the  value  of  T for  superexpressions.  The 
crucial  point  here  is  that  the  termination  function  gives  greater  weight  to  the  more  deeply 
nested  products  by  placing  their  size  at  a greater  depth  in  the  nested  multiset.  The 
effect  of  the  productions  on  lower-level  expressions  is  therefore  more  significant  than 
their  effect  on  higher-level  expressions,  and  the  decrease  in  T for  the  subexpression  to 
which  the  production  is  applied,  overshadows  any  increase  in  the  size  of  a 
superexpression. 

Consider,  for  example,  c i-(b-(c+d))  -*  a-((b-c)*(b-d))  . The  value  of  T for  the  expression 
on  the  left  is  {{7,  {5>»  , while  for  the  right-hand  side  expression  it  is  {{9,  {?},  {3»>  . 
Note  that  this  represents  a decrease  in  the  nested  multiset  ordering  over  N , despite  the 
fact  that  the  element  7 , corresponding  to  the  size  of  the  top-level  expression,  has  been 
increased  to  9 . This  is  the  case  since  the  production  has  replaced  the  element  {5}  in 
the  multiset  by  two  occurrences  of  the  smaller  {3}  , and  {5}  is  also  greater  than  9 — or 
any  number  for  that  matter  — on  account  of  its  greater  depth. 

Thus,  e-*e'  implies  T(e)»*T(e')  . n 


EXAMPLE  3:  Differentiation. 

The  following  system  symbolically  differentiates  an  expression  with  respect  to  x 


Dx  =* 

1 

Dy  => 

0 

D(a*0) 

=> 

(Da  + D6) 

D(a-0) 

=> 

( (0-Da)  + (a-D0) ) , 

D(-a) 

=*• 

( -Da  ) 

D(a-0) 

=> 

( Da  - D0  ) 

D(a/0) 

( (Da/0)  - ((a-D0)/(0T2))  ) 

D(ln  a) 

( Da  / a ) 

D(a)0) 

=> 

( (Da«(0*(aT(0-l))))  + (((/n  a)-D0Mat|S))  ) . 

• Solution  1 (Manna  and  Ness):  Take  (N,  » as  the  well-founded  set.  Let  the 
termination  function  T:£-*IU  be  defined  by 

T(cr®0)  = T(a)+T(0)  , 

where  ® is  any  of  the  binary  operators  + , • , - , and  T , 
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n 


I 

: 


1 


1 ■ 

■ 

f ! 


T(Do)  = T(a)2  , 

T(-a)  = T(a)+ 1 , 

T (In  a)  = T(a)+1  , 

and 

T (u)  = 4 . 

for  any  atom  u . (If  the  last  three  productions  were  not  included  in  the  system,  then 
T(u)=2  would  suffice.) 

1 ) For  each  of  the  nine  productions  , the  value  of  T decreases,  i.e.  T(*)>T(ir')  , 

For  example, 

T(D(ct/0))  = (T(a)+T(0))2  = T(a)2  + T(0)?  ♦ 2*T(a)*T(0)  , 

while 

T(((Da/0)-((a-D0)/(/3T2))))  = T(a)2  + T(0)2  + T(a)  + 2*T(0)  + 4 . 

This  is  a decrease,  since  2*T(a)*T(0)  i 4«T(a)+4«T(0)  > T(a)+2*T(0)+4  . 

2)  T is  monotonic  in  each  operand. 

It  follows  that  e-*e'  implies  T(f)>T(r')  . 


• Solution  2 (multisets):  To  prove  termination,  we  use  the  multiset  ordering  over 
sequences  of  natural  numbers.  The  sequences  are  compared  under  the  stepped, 
lexicographic  order  > , i.e.  longer  sequences  are  greater  than  shorter  ones  (regardless  of 
the  values  of  the  individual  elements),  and  equal  length  sequences  are  compared 
lexicographically.  The  termination  function  is 

T(f)  = {(<f,(x),  rf,(x).  . . . ) : x is  an  occurrence  of  an  atom  in  e}  , 

where  rf;(x)  Is  the  distance  (number  of  operators)  between  x and  the  ith  enclosing  D . 

For  example,  consider  the  expression 
e=DD(,Dy(y+DDx))  , 

or  in  tree  form  (with  the  D's  enumerated  for  expository  purposes), 
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D 


y\ 


?. 


There  are  three  atoms:  y , y , and  x . The  left  atom  y contributes  the  element 
(0,  2,  3)  to  the  multiset,  since  there  are  no  operators  between  D,  and  y , there  are  two 
operators  ( • and  D.  ) between  D„  and  y , and  there  are  three  operators  ( Z>2  , • , and 
D,  ) between  Dt  and  y . Similarly  the  other  two  atoms  contribute  (2,  3)  and 
(0,  1,  4,  5)  . Thus, 


T(f)  = { (0,  2,  3),  (2,  3),  (0,  1,  4,  5)  > . 


Applying  the  production 


D(«-0)  =>  ( (5-Da)  + («(•  DP) ) , 

to  e , yields  e'=  D(((.y+ D Dx)'DDy)+(DyD(y+DDx)))  . In  tree  form  (with  the  labelling  of  the 
D's  retained),  we  have 


x 


and  accordingly 


°r 


?• 

Dr 

x , 


T(f')  = { (3),  (0,  I.  5),  (0,  1,  4),  (0,  3).  (1,  4),  (0,  1,  3,  6)  } , 

Thus,  T(c)»T(/)  , since  the  element  (0,  I,  4,  5)  has  been  replaced  by  five  shorter 
sequences  and  by  the  lexicographically  smaller  (0,  1,  3,  6)  . 


i m 
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, In  general,  the  following  two  properties  hold: 

1 ) Applying  any  of  the  productions  decreases  T . Consider,  for  example,  what  happens  to 
the  multiset  T(e)  when  the  production 

D(a-0)  =;•  ( (0-D«)  + ( ct‘D0 ) ) 

is  applied  to  some  subexpression  of  e . Let  x be  an  atom  occurring  in  a . Applying  the 
production  results  in  replacing  the  sequence  J=(rff(x),  rf?(x),  . . . ) corresponding  to  x , 
with  two  sequences,  s'  and  s"  , corresponding  to  the  occurrences  of  x in  Da  and  a 
respectively.  But  s is  greater  than  both  and  s"  : the  sequence  s"  is  shorter  than  j 
since  there  is  one  less  D above  x ; the  sequence  s'  is  of  the  same  length  as  s , but  is 
lexicographically  less,  since  a D has  been  pushed  closer  to  x , while  the  distance  to 
nearer  D's  remains  unchanged.  Similarly,  the  sequences  corresponding  to  the  atoms  In 
0 are  replaced  by  two  smaller  sequences. 

j 2)  The  productions  only  affect  the  sequences  in  T(e)  corresponding  to  the  atoms  of  the 

subexpression  that  they  are  applied  to. 

Therefore,  for  any  application  of  a production,  e-+e'  implies  T(*)»T(*')  . 


• Solution  3 (nested  multisets):  Since  the  arguments  to  D are  reduced  in  size  by  each 
production,  and  none  of  the  productions  increase  the  nested  depth  of  D's  , nested 
multisets  constructed  from  the  sizes  of  the  arguments  of  D are  an  appropriate  tool. 

Let  the  well-founded  set  be  the  nested  multisets  over  the  natural  numbers, 

(W*m,  »*)  , and  let  the  termination  function  yield  |a|  for  each  occurrence 

of  Da  , while  preserving  the  nested  structure  of  the  expression.  For  example,  the 
arguments  of  the  six  occurrences  of  D in  the  expression  D(D(Dx'Dy)*Dy)/Dx  are 

D(Dx'Dy)+Dy  , Dx-Dy  , x , y , y , and  x . They  are  of  sizes  9,5,  1 , 1 , I , and  l , 
i * respectively.  Thus,  for 
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and  let  T(o)  and  rT3T  stand  for  the  list  of  elements  of  the  multisets  T(a)  and  t(/8)  , 
respectively.  Applying  T to  the  two  sides  of  the  production,  yields 

T (T)(a*0))  = { {|a*0|,  T(a),  T(0)}  } 

and 

n(lB-DaMcrl)<m  = { W),  <|a|.  T(S)},  t&),  {|/J|.  rtf)}  } . 

This  clearly  is  a decrease  in  , regardless  of  the  exact  form  of  a and  0 , since 

{|oe0|,  r(a),  Wl}  is  greater  than  {|a|,  Tfc)}  and  {|0|,  TW)}  , and  is  also  greater 
than  each  of  the  elements  in  t{o)  and  r(0)  . 

For  example, 

T (D(x-Dy))  = {{4,  {!>}}  . 

while 

T Ux'DDybWyDx)))  = {{2,  {!>>,  {!},  {1}}  . 

This  is  a decrease  in  the  nested  multiset  order,  since  {4,  {!>}  is  greater  than  both 

{2,  {!>}  and  {1}  . A similar  argument  applies  to  all  of  the  other  productions. 

2)  As  in  the  previous  example,  the  decrease  in  T for  the  lower-level  expression 
overshadows  any  increase  in  the  size  of  a higher-level  expression. 

It  follows  that  e-*e'  implies  T(r)»*T(r')  . n 


In  this  section,  we  have  illustrated  the  use  of  multiset  and  nested  multiset  orderings  in 
proofs  of  termination  of  production  systems,  by  means  of  a number  of  examples.  Along 
similar  lines,  using  these  orderings,  one  can  give  general  theorems  which  express 
sufficient  conditions  for  the  termination  of  broad  classes  of  production  systems. 
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